Detections
Analytics

Echo: linux: security update to 6.12.96-1

medium Tenable Self-Hosted Container Security Plugin ID 461187

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: teardown bugs and
 resource leaks Address several teardown issues and resource leaks in the driver's remove path and error
 handling: 1. Debounce clock reference leak: The debounce clock (bank->db_clk) is obtained using
 of_clk_get() which increments the clock's reference count, but clk_put() is never called. Register a devm
 action to cleanly release it on unbind. Note that of_clk_get(..., 1) remains necessary over devm_clk_get()
 because the DT binding does not define clock-names, precluding name-based lookup. 2. Unregistered chained
 IRQ handler: The chained IRQ handler is not disconnected in remove(). If a stray interrupt fires after the
 driver is removed, the kernel attempts to execute a stale handler, leading to a panic. Fix this by
 clearing the handler in remove(). 3. IRQ domain leak: The linear IRQ domain and its generic chips are
 allocated manually during probe but never removed. Remove the IRQ domain during driver teardown to free
 the associated generic chips and mappings. [Bartosz: don't emit an error message on devres allocation
 failure] (CVE-2026-64241)

Solution

Update the linux library and its related packages to version 6.12.96-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-64241

Plugin Details

Severity: Medium

ID: 461187

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.72

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-64241

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/25/2026

Vulnerability Publication Date: 7/23/2026

Reference Information

CVE: CVE-2026-64241